SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,481 copies16 likes159,612 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects the usage of 'schtasks.exe' with the '/delete' flag and the '/tn *' argument, which is used to delete all scheduled tasks on a local Windows system, including those created by other users. This activity can be indicative of an adversary attempting to disrupt system operations or remove forensic evidence.
Detects the creation of scheduled tasks using `schtasks.exe` that are configured to run once at exactly 00:00 and execute suspicious commands or scripts. The suspicious commands include common scripting engines (wscript, cscript, powershell), WMI, regsvr32, or executables located in the AppData directory. This pattern is often used by adversaries for persistence or execution at a specific, often stealthy, time.
Detects the use of stordiag.exe, a legitimate Windows utility, to execute other system binaries like schtasks.exe, systeminfo.exe, and fltmc.exe. This behavior can be indicative of an adversary attempting to bypass defenses by proxying execution through a trusted binary, a technique often associated with System Binary Proxy Execution (T1218). The rule specifically filters out executions where stordiag.exe is launched from its default system paths to reduce false positives, focusing on instances where it might be copied or used from non-standard locations.
Detects the execution of the built-in Windows script "gatherNetworkInfo.vbs" which is commonly used to collect network configuration details and other system information. This activity can be indicative of reconnaissance by an adversary.
This rule detects the execution of a process where the 'Image' field (representing the executable path) is not a full, absolute path. This behavior can be indicative of techniques like process ghosting or other methods used to start processes in an unorthodox way, often to evade detection. The rule specifically filters out null or empty image paths and common system processes to reduce false positives.
Detects the execution of suspicious scripts (PowerShell, MSHTA, WScript, CScript) from common temporary directories. Adversaries often stage and execute malicious scripts from temporary folders to evade detection and blend in with legitimate system activity. The rule specifically looks for these script interpreters being launched with command lines that include paths to temporary directories, while filtering out some known legitimate activities.
This rule detects the execution of 'te.exe', the Windows Test Authoring and Execution Framework (TAEF) executable. Adversaries can abuse 'te.exe' to proxy the execution of malicious scripts or binaries, such as Windows Script Components (WSC) files containing VBScript or DLLs, thereby bypassing security controls. The rule specifically looks for 'te.exe' being executed as the main image, a parent image, or identified by its original filename.
This rule detects the execution of a new process where the parent process is `vsjitdebugger.exe`, the Microsoft Visual Studio Just-In-Time Debugger. Adversaries may abuse this legitimate, signed binary to proxy the execution of malicious code, thereby evading defenses that trust signed executables. The rule includes exclusions for common legitimate child processes of `vsjitdebugger.exe` to reduce false positives.
This rule detects instances where 'svchost.exe' is spawned by an uncommon parent process. It specifically filters out common and legitimate parent processes such as 'Mrt.exe', 'MsMpEng.exe', 'ngen.exe', 'rpcnet.exe', 'services.exe', and 'TiWorker.exe', as well as cases where the parent process is null or empty. This helps to identify potential masquerading or defense evasion attempts where an adversary might try to hide malicious activity by naming their process 'svchost.exe' and having it spawned by an unusual parent.
Detects suspicious execution of Sysinternals PsSuspend, where the utility is used to suspend critical processes such as AV or EDR to bypass defenses. The rule specifically looks for the execution of 'pssuspend.exe' or 'pssuspend64.exe' with 'msmpeng.exe' in the command line, which is the executable for Microsoft Defender Antivirus.
Page 570 of 680